This post originated from an RSS feed registered with Java Buzz by Charles Miller. Original Post: Pwn2Yawn Feed Title: The Fishbowl Feed URL: https://fishbowl.pastiche.org/atom.xml Feed Description: tail -f /dev/mind > blog Latest Java Buzz Posts Latest Java Buzz Posts by Charles Miller Latest Posts From The Fishbowl

For those who aren't up to speed, Pwn2Own is a competition held at CanSecWest for the last two years. The first contestant who can hack into one of a couple of laptops prepared for the competition wins a cash prize, and gets to keep the laptop. Both years the winner was a security researcher named Charlie Miller (no relation), leading to occasional amusing instances of mistaken identity.

I have nothing against my namesake, but I must say I find the premise of the competition annoying.

It is incredibly hard to believe that any security researcher is going to find a new exploit against a given operating system and set of applications over the course of a few hours of competition. It is far more likely, and has been the case so far, that competitors show up with exploits already prepared. This year's competition came down purely to a roll of the dice: which researcher would get the chance to pull their “here’s one I prepared earlier” from the oven first?¹

Or to put it more bluntly, Pwn2Own provides a cash incentive for security researchers to keep vulnerabilities secret in the hope they will remain unpatched until competition day.

¹ The cynic in me wonders how random the process was that selected the most headline-friendly result: “Last year’s winner hacks Safari again!”